SNC JCO3 Error: SNC name and specified user/client do not match

[Niko1]

Hi experts,

I am encountering the above error when attempting to connect via my JCO3 Java application to a SAP Netweaver server. 

Weirdly though, I am able to connect via SAP Logon using SNC, with the same parameters (host ip, system number, client number etc.). The Java program is using the same security files as SAP Logon (certificates). If I disable SNC, the Java program can connect normally.

Some consideration (not sure if relevant):

Since in my case the SAP Logon runs on x32 bit, and java on x64 bit, I am using a different version of sapcrypto.exe. However, all the other files I did not change (certificate.crt, pse file, cred_v2 file). All these files were created using the x32 bit sapgenpse.exe, and they were not changed.

Anyone know what might be the issue here? Help is very much appreciated!

Thank you,

Niko

[HAL9000 · Accepted solution]

If you disable SNC and the Java program succeeds with the logon, you must have specified additional logon credentials, for example a user ID and a password.
Therefore you do not have the same parameters as with SAP Logon, or where did you, for example, specify the password in SAP Logon?
If you would like to use SNC, and not use the SNC certificate identity, but some other configured user credentials for the RFC logon, then you have to specify jco.client.snc_sso=0 in addition.
If SNC is enabled, jco.client.snc_sso=1 is the default and means that the SNC certificate identity shall also be used for the RFC logon. In this case, no other user credentials would be required.

[Ulrich_Schmidt · Accepted solution]

Two additional points:

1.
> I am using a different version of sapcrypto.exe
You probably mean sapcrypto.dll? In any case, please make sure that, even though one is 32bit and the other one 64bit, the sapcrypto library on both sides (backend and frontend) have the same "version" (meaning "release version", not 32/64 bit).  I already saw problems like these being caused by one side using a pretty old and the other side a newer version of sapcrypto.dll. If, for example, SAPGUI and JCo are using the DLL from the same installation of SAP Secure Login Client (which usually installs 32 and 64bit DLLs), then you should be on the safe side.

2.
Is the Java program running under the same Windows user as the sapgui.exe? There is a one-to-one correspondence between OS user and PSE/cred_v2 credentials, so if Java runs under a different user, e.g. SYSTEM in case of a background Service, then this would explain the problem
If you provide the exact error message & stack trace you get, we might be able to tell you what's wrong... (E.g. it is quite a difference, whether the error message comes from the local sapcrypto.dll, or from the ABAP backend.)

[Niko1 · Accepted solution]

Thank you Hal and Ulrich for the prompt response!

Regarding the credentials, the Java does use username and pass. The SAP Logon is used without SSO, so SNC enabled, and after connecting I still need to enter username and password.

I will double check the sapcrypto file versions and users running the Java and SAP Logon. 

Below is the error thrown by the Java JCO3:

com.sap.conn.jco.JCoException: (103) JCO_ERROR_LOGON_FAILURE: Initialization of repository destination example failed: SNC name and specified user/client do not match
 at com.sap.conn.jco.rt.RfcDestination.getSystemID(RfcDestination.java:1651)
.....
Caused by: com.sap.conn.jco.JCoException: (103) JCO_ERROR_LOGON_FAILURE: SNC name and specified user/client do not match (remote system is ....)
 at com.sap.conn.jco.rt.AbstractConnection.generateJCoException(AbstractConnection.java:615)
....
Caused by: RfcException raised by system [...] for user [TESTUSER]:
 message: SNC name and specified user/client do not match
 return code: RFC_SYS_EXCEPTION (RFC_SYS_EXCEPTION)
 error group: RFC_ERROR_LOGON_FAILURE
 at com.sap.conn.rfc.api.RfcApi.RfcOpen(RfcApi.java:223)
 at com.sap.conn.jco.rt.ClientConnection.connectInternal(ClientConnection.java:619)
 ... 14 more
Caused by: RfcException raised by system [....]:
 message: SNC name and specified user/client do not match
 return code: RFC_SYS_EXCEPTION (RFC_SYS_EXCEPTION)
 error group: RFC_ERROR_SYSTEM_FAILURE
 at com.sap.conn.rfc.engine.RfcIoOpenCntl.RfcReceive(RfcIoOpenCntl.java:2138)
 at com.sap.conn.rfc.api.RfcApi.RfcOpen(RfcApi.java:203)
 ... 15 more
Caused by: com.sap.conn.rfc.exceptions.RfcGetException: SNC name and specified user/client do not match
 at com.sap.conn.rfc.engine.RfcImp.ab_rfcerror(RfcImp.java:932)
 at com.sap.conn.rfc.engine.RfcGet.ab_rfcget(RfcGet.java:195)
 ... 18 more

Thank you so much!

[HAL9000 · Accepted solution]

Then specifying jco.client.snc_sso=0 will most likely resolve the error.
The error seems to originate from the situation that JCo tried to do an RFC logon with the SNC certificate identity, but the additionally specified optional jco.client.user identity does not fit to the user ID which is configured at ABAP side for this SNC identity. Maybe the SNC certificate isn't a user certificate at all, but a system certificate instead, with which one cannot logon to an ABAP system.

[Niko1 · Accepted solution]

Yes, setting SNC_SSO=0 resolved the issue. Thank you so much for your help!